Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update opt.zoom.ZoomLauncher #3

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update opt.zoom.ZoomLauncher #3

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
25d6ba7
Update opt.zoom.ZoomLauncher
drzraf Apr 26, 2022
8068106
aa-cleanprof
Apr 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 34 additions & 29 deletions opt.zoom.ZoomLauncher
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,25 @@
# Last Modified: Mon Apr 25 22:40:23 2022
include <tunables/global>
# Last Modified: Tue Apr 26 11:45:27 2022
#include <tunables/global>

/opt/zoom/ZoomLauncher flags=(complain) {
include <abstractions/X>
include <abstractions/audio>
include <abstractions/base>
include <abstractions/dbus-accessibility-strict>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/nameservice>
include <abstractions/openssl>
include <abstractions/private-files-strict>
include <abstractions/user-tmp>
include <abstractions/video>
include <abstractions/wayland>
/opt/zoom/ZoomLauncher {
#include <abstractions/X>
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/dbus-accessibility-strict>
#include <abstractions/dbus-session-strict>
#include <abstractions/dbus-strict>
#include <abstractions/fonts>
#include <abstractions/freedesktop.org>
#include <abstractions/nameservice>
#include <abstractions/openssl>
#include <abstractions/private-files-strict>
#include <abstractions/user-tmp>
#include <abstractions/video>
#include <abstractions/wayland>

dbus (receive send) bus=accessibility,
network netlink dgram,

dbus (receive send) bus=system path=/org/freedesktop/NetworkManager/Settings,
dbus receive bus=session interface=org.a11y.atspi**,
dbus receive bus=system path=/org/freedesktop/NetworkManager,
dbus send bus=session peer=(name=org.a11y.Bus),
Expand All @@ -27,11 +29,19 @@ include <tunables/global>
signal send set=usr2 peer=/usr/bin/pacmd,

deny ptrace read peer=/usr/bin/pidof,
deny ptrace read peer=pidof,
deny ptrace trace,

ptrace read peer=/opt/zoom/QtWebEngineProcess,
ptrace read peer=/usr/bin/pacmd,

unix (bind) type=dgram,

deny /usr/bin/pidof x,
deny /{,usr/}bin/dash x,
deny /{,usr/}bin/grep x,
deny /{,usr/}bin/ps x,
deny /{,usr/}bin/readlink x,
deny @{HOME}/.Private mrwlk,
deny @{PROC}/[0-9]*/cmdline mrwlk,

Expand Down Expand Up @@ -78,7 +88,6 @@ include <tunables/global>
/usr/bin/mkfifo rUx, # investigate
/usr/bin/pacmd ix,
/usr/bin/pactl ix,
/usr/bin/pidof Ux,
/usr/bin/xdg-open rUx,
/usr/share/fontconfig/conf.avail/** r,
/usr/share/fonts/truetype/** mr,
Expand All @@ -89,20 +98,18 @@ include <tunables/global>
/usr/share/themes/Default/gtk-3.0/gtk-keys.css r,
/var/lib/flatpak/exports/share/mime/mime.cache m,
/{,usr/}bin/cat ix,
/{,usr/}bin/dash ix,
/{,usr/}bin/grep ix,
/{,usr/}bin/ps rUx,
/{,usr/}bin/readlink ix,
/{,usr/}bin/uname rUx,
/{,usr/}sbin/killall5 ix,
@{PROC} r,
@{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/oom_score_adj w,
@{PROC}/@{pid}/setgroups w,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/* r,
@{PROC}/@{pid}/task/comm rw,
@{PROC}/[0-9]*/net/dev r,
@{PROC}/[0-9]*/net/if_inet6 r,
@{PROC}/[0-9]*/net/ipv6_route r,
@{PROC}/[0-9]*/net/wireless r,
@{PROC}/bus/pci/devices r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
@{PROC}/sys/kernel/osrelease r,
Expand All @@ -111,6 +118,7 @@ include <tunables/global>
owner "@{HOME}/.config/Unknown Organization/**" rwk,
owner /dev/shm/.org.chromium.Chromium* mrw,
owner /{,var/}run/user/*/dconf/user rw,
owner /{,var/}run/user/[0-9]*/pulse/cli rw,
owner @{HOME}/.cache/mesa_shader_cache/ rw,
owner @{HOME}/.cache/mesa_shader_cache/** rwk,
owner @{HOME}/.cache/mesa_shader_cache/index mrw,
Expand All @@ -123,8 +131,6 @@ include <tunables/global>
owner @{HOME}/.cache/zoom/qmlcache/ mrwk,
owner @{HOME}/.cache/zoom/qmlcache/** mrwk,
owner @{HOME}/.config/.@{pid} rwk,
owner @{HOME}/.config/.J* rwk,
owner @{HOME}/.config/.T* rwk,
owner @{HOME}/.config/QtProject.conf r,
owner @{HOME}/.config/dconf/user rw,
owner @{HOME}/.config/gtk-3.0/settings.ini r,
Expand All @@ -144,12 +150,11 @@ include <tunables/global>
owner @{HOME}/Documents/Zoom/ rwk,
owner @{HOME}/Documents/Zoom/** rwk,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,


profile lsb_release {
include <abstractions/base>
include <abstractions/python>
#include <abstractions/base>
#include <abstractions/python>

deny /tmp/gtalkplugin.log w,

Expand Down